Ceilometer Gnocchi upgrade fails with TLS everywhere

Bug #1787959 reported by Juan Antonio Osorio Robles
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
tripleo
Fix Released
High
Juan Antonio Osorio Robles

Bug Description

When deploying, we get the following error:

            "Error running ['docker', 'run', '--name', 'ceilometer_gnocchi_upgrade', '--label', 'config_id=tripleo_step5', '--label', 'container_name=ceilometer_gnocchi_upgrade', '--label', 'managed_by=paunch', '--label', 'config_data={\"start_order\": 99, \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"image\": \"192.168.24.1:8787/tripleoqueens/centos-binary-ceilometer-central:current-tripleo-rdo\", \"command\": [\"/usr/bin/bootstrap_host_exec\", \"ceilometer_agent_central\", \"su ceilometer -s /bin/bash -c \\'for n in {1..10}; do /usr/bin/ceilometer-upgrade --skip-metering-database && exit 0 || sleep 30; done; exit 1\\'\"], \"user\": \"root\", \"volumes\": [\"/etc/hosts:/etc/hosts:ro\", \"/etc/localtime:/etc/localtime:ro\", \"/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro\", \"/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro\", \"/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro\", \"/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro\", \"/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro\", \"/dev/log:/dev/log\", \"/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro\", \"/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro\", \"/etc/puppet:/etc/puppet:ro\", \"/var/lib/config-data/ceilometer/etc/ceilometer/:/etc/ceilometer/:ro\", \"/var/log/containers/ceilometer:/var/log/ceilometer\"], \"net\": \"host\", \"detach\": false, \"privileged\": false}', '--net=host', '--health-cmd=/openstack/healthcheck', '--privileged=false', '--user=root', '--volume=/etc/hosts:/etc/hosts:ro', '--volume=/etc/localtime:/etc/localtime:ro', '--volume=/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro', '--volume=/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro', '--volume=/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro', '--volume=/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro', '--volume=/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro', '--volume=/dev/log:/dev/log', '--volume=/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro', '--volume=/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro', '--volume=/etc/puppet:/etc/puppet:ro', '--volume=/var/lib/config-data/ceilometer/etc/ceilometer/:/etc/ceilometer/:ro', '--volume=/var/log/containers/ceilometer:/var/log/ceilometer', '192.168.24.1:8787/tripleoqueens/centos-binary-ceilometer-central:current-tripleo-rdo', '/usr/bin/bootstrap_host_exec', 'ceilometer_agent_central', \"su ceilometer -s /bin/bash -c 'for n in {1..10}; do /usr/bin/ceilometer-upgrade --skip-metering-database && exit 0 || sleep 30; done; exit 1'\"]. [1]"

The logs from /var/log/containers/gnocchi/app.log show:

ToozConnectionError: Error 8 connecting to 172.16.2.32:6379. EOF occurred in violation of protocol (_ssl.c:579).
2018-08-20 14:15:52,693 [18] ERROR gnocchi.utils: Unable to initialize coordination driver
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/tenacity/__init__.py", line 298, in call
    result = fn(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/gnocchi/cli/metricd.py", line 45, in get_coordinator_and_start
    coord.start(start_heart=True)
  File "/usr/lib/python2.7/site-packages/tooz/coordination.py", line 687, in start
    super(CoordinationDriverWithExecutor, self).start(start_heart)
  File "/usr/lib/python2.7/site-packages/tooz/coordination.py", line 423, in start
    self._start()
  File "/usr/lib/python2.7/site-packages/tooz/drivers/redis.py", line 449, in _start
    self._server_info = self._client.info()
  File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__
    self.gen.throw(type, value, traceback)
  File "/usr/lib/python2.7/site-packages/tooz/drivers/redis.py", line 51, in _translate_failures
    cause=e)
  File "/usr/lib/python2.7/site-packages/tooz/utils.py", line 225, in raise_with_cause
    excutils.raise_with_cause(exc_cls, message, *args, **kwargs)
  File "/usr/lib/python2.7/site-packages/oslo_utils/excutils.py", line 143, in raise_with_cause
    six.raise_from(exc_cls(message, *args, **kwargs), kwargs.get('cause'))
  File "/usr/lib/python2.7/site-packages/six.py", line 718, in raise_from
    raise value
ToozConnectionError: Error 8 connecting to 172.16.2.32:6379. EOF occurred in violation of protocol (_ssl.c:579).

The issue seems to be the redis_tls_proxy container, which shows this error:

INFO:__main__:Writing out command to execute
++ cat /run_command
+ CMD='stunnel /etc/stunnel/stunnel.conf'
+ ARGS=
+ [[ ! -n '' ]]
+ . kolla_extend_start
++ [[ ! -d /var/log/kolla/redis ]]
+++ stat -c %a /var/log/kolla/redis
++ [[ 2755 != \7\5\5 ]]
++ chmod 755 /var/log/kolla/redis
+ echo 'Running command: '\''stunnel /etc/stunnel/stunnel.conf'\'''
+ exec stunnel /etc/stunnel/stunnel.conf
Running command: 'stunnel /etc/stunnel/stunnel.conf'
Clients allowed=512000
stunnel 4.56 on x86_64-redhat-linux-gnu platform
Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013
Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP
Reading configuration from file /etc/stunnel/stunnel.conf
FIPS mode is enabled
Compression not enabled
PRNG seeded successfully
Initializing service [redis]
/etc/pki/tls/private/redis.key: No such file or directory (2)
Service [redis]: Failed to initialize SSL context
str_stats: 10 block(s), 1027 data byte(s), 580 control byte(s)

Changed in tripleo:
importance: Undecided → High
status: New → Triaged
milestone: none → stein-1
assignee: nobody → Juan Antonio Osorio Robles (juan-osorio-robles)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to tripleo-heat-templates (master)

Fix proposed to branch: master
Review: https://review.openstack.org/593642

Changed in tripleo:
status: Triaged → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to tripleo-heat-templates (master)

Reviewed: https://review.openstack.org/593642
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=c41c427ad6bf6ce787dd40ba99919a26a6560349
Submitter: Zuul
Branch: master

commit c41c427ad6bf6ce787dd40ba99919a26a6560349
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Mon Aug 20 17:24:44 2018 +0300

    Redis: Mount certificates on TLS proxy

    We were mounting the TLS certificates on the redis container and not on
    the proxy itself.

    Change-Id: I52c53103362371ea1a82130e1ee48fef2d194bed
    Closes-Bug: #1787959

Changed in tripleo:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to tripleo-heat-templates (stable/queens)

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/594003

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to tripleo-heat-templates (stable/queens)

Reviewed: https://review.openstack.org/594003
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=08e0aeee52cf8dce8543801d4f9cdc21cbdc3440
Submitter: Zuul
Branch: stable/queens

commit 08e0aeee52cf8dce8543801d4f9cdc21cbdc3440
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Mon Aug 20 17:24:44 2018 +0300

    Redis: Mount certificates on TLS proxy

    We were mounting the TLS certificates on the redis container and not on
    the proxy itself.

    Change-Id: I52c53103362371ea1a82130e1ee48fef2d194bed
    Closes-Bug: #1787959
    (cherry picked from commit c41c427ad6bf6ce787dd40ba99919a26a6560349)

tags: added: in-stable-queens
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/tripleo-heat-templates 9.0.0.0rc1

This issue was fixed in the openstack/tripleo-heat-templates 9.0.0.0rc1 release candidate.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/tripleo-heat-templates 8.0.6

This issue was fixed in the openstack/tripleo-heat-templates 8.0.6 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.